Create access token
Creates a new access token with the specified name, description, expiration, and permissions.
All access-token management endpoints are available only when the server-side auth_enabled setting is true. If auth_enabled is false, the server rejects these requests with 403 Forbidden.
Permission model
Access token permissions use a bitmask model.
| Name | Value | Meaning |
|---|---|---|
read | 1 | Read access |
write | 2 | Write access |
admin | 4 | Admin access |
admin is an independent permission bit. It does not automatically grant read or write.
Common combinations:
| Bitmask | Permission string | Meaning |
|---|---|---|
| 1 | read | Read only |
| 2 | write | Write only |
| 4 | admin | Admin only |
| 5 | read,admin | Read and admin |
| 6 | write,admin | Write and admin |
| 7 | read,write,admin | Read, write, and admin |
The create-token API accepts the canonical comma-separated permission names, and the server stores them as the corresponding bitmask.
When using an admin JWT, the server uses the persisted JWT secret from server_params.btr. If ACTIAN_VECTORAI_JWT_SECRET is set at startup, that value overrides the persisted secret and is saved for subsequent restarts.
Authorizations
Admin JWT obtained from the login endpoint.
Headers
Admin JWT or admin access token. Format Bearer <admin-jwt-or-access-token>.
Body
Human-readable name for the token.
Comma-separated permission names. Valid values are read, write, admin, or any combination.
"read,admin"
Optional description of the token's intended use.
Whether the token expires. When false, the token is valid indefinitely.
Number of seconds until the token expires. Only applies when will_expire is true.
Response
Token created successfully.
Unique identifier for the access token.
Human-readable name for the token.
Description of the token's intended use.
The raw access token value. Store this securely, as it cannot be retrieved after creation.
Timestamp when the token was created, in RFC 3339 UTC format.
Timestamp when the token expires, in RFC 3339 UTC format. null when will_expire is false.
Whether the token has an expiration date.
Comma-separated permission names assigned to the token.